The following changes since commit d90f154867ec0ec22fd719164b88716e8fd48672:

Merge remote-tracking branch 'remotes/dg-gitlab/tags/ppc-for-6.1-20210504' into staging (2021-05-05 20:29:14 +0100)

are available in the git repository at:

for you to fetch changes up to 4f8a39494aded9f2026a26b137378ea2ee3d5338:

tap-bsd: Remove special casing for older OpenBSD releases (2021-05-27 11:03:55 +0800)

Brad Smith (1):

tap-bsd: Remove special casing for older OpenBSD releases

Guenter Roeck (1):

hw/net/imx_fec: return 0xffff when accessing non-existing PHY

Laurent Vivier (1):

virtio-net: failover: add missing remove_migration_state_change_notifier()

hw/net/imx_fec.c | 8 +++-----

hw/net/trace-events | 2 ++

hw/net/virtio-net.c | 1 +

net/tap-bsd.c | 8 --------

4 files changed, 6 insertions(+), 13 deletions(-)

From: Guenter Roeck <linux@roeck-us.net>

If a PHY does not exist, attempts to read from it should return 0xffff.

Otherwise the Linux kernel will believe that a PHY is there and select

the non-existing PHY. This in turn will result in network errors later

on since the real PHY is not selected or configured.

Since reading from or writing to a non-existing PHY is not an emulation

error, replace guest error messages with traces.

Fixes: 461c51ad4275 ("Add a phy-num property to the i.MX FEC emulator")

Cc: Jean-Christophe Dubois <jcd@tribudubois.net>

Reviewed-by: Bin Meng <bmeng.cn@gmail.com>

Tested-by: Bin Meng <bmeng.cn@gmail.com>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Guenter Roeck <linux@roeck-us.net>

hw/net/imx_fec.c | 8 +++-----

hw/net/trace-events | 2 ++

2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c

--- a/hw/net/imx_fec.c

+++ b/hw/net/imx_fec.c

@@ -XXX,XX +XXX,XX @@ static uint32_t imx_phy_read(IMXFECState *s, int reg)

uint32_t phy = reg / 32;

if (phy != s->phy_num) {

- qemu_log_mask(LOG_GUEST_ERROR, "[%s.phy]%s: Bad phy num %u\n",

- TYPE_IMX_FEC, __func__, phy);

- return 0;

+ trace_imx_phy_read_num(phy, s->phy_num);

+ return 0xffff;

reg %= 32;

@@ -XXX,XX +XXX,XX @@ static void imx_phy_write(IMXFECState *s, int reg, uint32_t val)

uint32_t phy = reg / 32;

if (phy != s->phy_num) {

- qemu_log_mask(LOG_GUEST_ERROR, "[%s.phy]%s: Bad phy num %u\n",

- TYPE_IMX_FEC, __func__, phy);

+ trace_imx_phy_write_num(phy, s->phy_num);

diff --git a/hw/net/trace-events b/hw/net/trace-events

--- a/hw/net/trace-events

+++ b/hw/net/trace-events

@@ -XXX,XX +XXX,XX @@ i82596_channel_attention(void *s) "%p: Received CHANNEL ATTENTION"

# imx_fec.c

imx_phy_read(uint32_t val, int phy, int reg) "0x%04"PRIx32" <= phy[%d].reg[%d]"

+imx_phy_read_num(int phy, int configured) "read request from unconfigured phy %d (configured %d)"

imx_phy_write(uint32_t val, int phy, int reg) "0x%04"PRIx32" => phy[%d].reg[%d]"

+imx_phy_write_num(int phy, int configured) "write request to unconfigured phy %d (configured %d)"

imx_phy_update_link(const char *s) "%s"

imx_phy_reset(void) ""

imx_fec_read_bd(uint64_t addr, int flags, int len, int data) "tx_bd 0x%"PRIx64" flags 0x%04x len %d data 0x%08x"

2.7.4

From: Laurent Vivier <lvivier@redhat.com>

In the failover case configuration, virtio_net_device_realize() uses an

add_migration_state_change_notifier() to add a state notifier, but this

notifier is not removed by the unrealize function when the virtio-net

card is unplugged.

If the card is unplugged and a migration is started, the notifier is

called and as it is not valid anymore QEMU crashes.

This patch fixes the problem by adding the

remove_migration_state_change_notifier() in virtio_net_device_unrealize().

The problem can be reproduced with:

$ qemu-system-x86_64 -enable-kvm -m 1g -M q35 \

-device pcie-root-port,slot=4,id=root1 \

-device pcie-root-port,slot=5,id=root2 \

-device virtio-net-pci,id=net1,mac=52:54:00:6f:55:cc,failover=on,bus=root1 \

-monitor stdio disk.qcow2

(qemu) device_del net1

(qemu) migrate "exec:gzip -c > STATEFILE.gz"

Thread 1 "qemu-system-x86" received signal SIGSEGV, Segmentation fault.

0x0000000000000000 in ?? ()

(gdb) bt

#0 0x0000000000000000 in ()

#1 0x0000555555d726d7 in notifier_list_notify (...)

at .../util/notify.c:39

#2 0x0000555555842c1a in migrate_fd_connect (...)

at .../migration/migration.c:3975

#3 0x0000555555950f7d in migration_channel_connect (...)

error@entry=0x0) at .../migration/channel.c:107

#4 0x0000555555910922 in exec_start_outgoing_migration (...)

at .../migration/exec.c:42

Reported-by: Igor Mammedov <imammedo@redhat.com>

Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>

Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

Signed-off-by: Laurent Vivier <lvivier@redhat.com>

hw/net/virtio-net.c | 1 +

1 file changed, 1 insertion(+)

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c

--- a/hw/net/virtio-net.c

+++ b/hw/net/virtio-net.c

@@ -XXX,XX +XXX,XX @@ static void virtio_net_device_unrealize(DeviceState *dev)

if (n->failover) {

device_listener_unregister(&n->primary_listener);

+ remove_migration_state_change_notifier(&n->migration_state);

max_queues = n->multiqueue ? n->max_queues : 1;

2.7.4

From: Brad Smith <brad@comstyle.com>

OpenBSD added support for tap(4) 10 releases ago.

Remove the special casing for older releases.

Signed-off-by: Brad Smith <brad@comstyle.com>

net/tap-bsd.c | 8 --------

1 file changed, 8 deletions(-)

diff --git a/net/tap-bsd.c b/net/tap-bsd.c

--- a/net/tap-bsd.c

+++ b/net/tap-bsd.c

@@ -XXX,XX +XXX,XX @@

#include <net/if_tap.h>

#endif

-#if defined(__OpenBSD__)

-#include <sys/param.h>

-#endif

#ifndef __FreeBSD__

int tap_open(char *ifname, int ifname_size, int *vnet_hdr,

int vnet_hdr_required, int mq_required, Error **errp)

@@ -XXX,XX +XXX,XX @@ int tap_open(char *ifname, int ifname_size, int *vnet_hdr,

if (*ifname) {

snprintf(dname, sizeof dname, "/dev/%s", ifname);

} else {

-#if defined(__OpenBSD__) && OpenBSD < 201605

- snprintf(dname, sizeof dname, "/dev/tun%d", i);

-#else

snprintf(dname, sizeof dname, "/dev/tap%d", i);

-#endif

}

TFR(fd = open(dname, O_RDWR));

if (fd >= 0) {

2.7.4